From 0a29bc4c29d8452fbb9a2ad75bba3a013fd414e7 Mon Sep 17 00:00:00 2001 From: Mykola Solianko Date: Fri, 15 Aug 2025 15:46:31 +0300 Subject: [PATCH 1/8] [container] Allow fs bind Signed-off-by: Mykola Solianko Reviewed-by: Oleksandr Grytsov Reviewed-by: Mykola Kobets --- policy/modules/services/container.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te index f4cf3edbdc..8e159d0ab3 100644 --- a/policy/modules/services/container.te +++ b/policy/modules/services/container.te @@ -751,6 +751,8 @@ kernel_read_vm_overcommit_sysctl(container_engine_t) kernel_search_vm_sysctl(container_engine_t) +kernel_request_load_module(container_engine_t) + term_remount_devpts(container_engine_t) init_rw_script_stream_sockets(container_engine_t) From c7559e5fc865d7fbec3d80cb62409c9cee988b70 Mon Sep 17 00:00:00 2001 From: Mykola Solianko Date: Wed, 21 Jan 2026 22:24:00 +0200 Subject: [PATCH 2/8] [init] Add init_mounton_initrc_runtime interface Signed-off-by: Mykola Solianko Reviewed-by: Mykola Kobets Reviewed-by: Oleksandr Grytsov Reviewed-by: Mykhailo Lohvynenko --- policy/modules/system/init.if | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/policy/modules/system/init.if b/policy/modules/system/init.if index a301ed3053..04ad395fb5 100644 --- a/policy/modules/system/init.if +++ b/policy/modules/system/init.if @@ -3094,6 +3094,25 @@ interface(`init_manage_dir_utmp',` allow $1 initrc_runtime_t:dir manage_dir_perms; ') +######################################## +## +## Mounton initrc runtime files and directories. +## +## +## +## Domain allowed access. +## +## +# +interface(`init_mounton_initrc_runtime',` + gen_require(` + type initrc_runtime_t; + ') + + allow $1 initrc_runtime_t:dir mounton; + allow $1 initrc_runtime_t:file mounton; +') + ######################################## ## ## Remove chr file perms from utmp. From ebdc1088821490c1adca50db92dce28637cf4787 Mon Sep 17 00:00:00 2001 From: Mykola Solianko Date: Wed, 21 Jan 2026 22:25:04 +0200 Subject: [PATCH 3/8] [iptables] Allow reading initrc runtime files Signed-off-by: Mykola Solianko Reviewed-by: Mykola Kobets Reviewed-by: Oleksandr Grytsov Reviewed-by: Mykhailo Lohvynenko --- policy/modules/system/iptables.te | 1 + 1 file changed, 1 insertion(+) diff --git a/policy/modules/system/iptables.te b/policy/modules/system/iptables.te index b9b0b357d5..423356a44d 100644 --- a/policy/modules/system/iptables.te +++ b/policy/modules/system/iptables.te @@ -93,6 +93,7 @@ init_use_script_ptys(iptables_t) init_rw_script_pipes(iptables_t) init_rw_script_tmp_files(iptables_t) init_rw_script_stream_sockets(iptables_t) +init_read_utmp(iptables_t) logging_send_syslog_msg(iptables_t) From 5605a5724a0333349555cd7f146f0a7a6ca6d805 Mon Sep 17 00:00:00 2001 From: Mykola Solianko Date: Wed, 21 Jan 2026 22:26:04 +0200 Subject: [PATCH 4/8] [dnsmasq] Allow managing initrc runtime for CNI Signed-off-by: Mykola Solianko Reviewed-by: Mykola Kobets Reviewed-by: Oleksandr Grytsov Reviewed-by: Mykhailo Lohvynenko --- policy/modules/services/dnsmasq.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policy/modules/services/dnsmasq.te b/policy/modules/services/dnsmasq.te index 4a0c3552f3..fab57cef22 100644 --- a/policy/modules/services/dnsmasq.te +++ b/policy/modules/services/dnsmasq.te @@ -53,6 +53,8 @@ allow dnsmasq_t dnsmasq_var_log_t:file setattr_file_perms; files_read_runtime_files(dnsmasq_t) systemd_read_resolved_dir(dnsmasq_t) files_map_etc_files(dnsmasq_t) +init_manage_utmp(dnsmasq_t) +init_manage_dir_utmp(dnsmasq_t) systemd_read_resolved_runtime(dnsmasq_t) From d53378f31d54f41f664eac6eea284fe4af6fee0b Mon Sep 17 00:00:00 2001 From: Mykola Solianko Date: Wed, 21 Jan 2026 22:26:56 +0200 Subject: [PATCH 5/8] [container] Allow managing initrc runtime dirs and files Signed-off-by: Mykola Solianko Reviewed-by: Mykola Kobets Reviewed-by: Oleksandr Grytsov Reviewed-by: Mykhailo Lohvynenko --- policy/modules/services/container.te | 3 +++ 1 file changed, 3 insertions(+) diff --git a/policy/modules/services/container.te b/policy/modules/services/container.te index 8e159d0ab3..385ac1b52e 100644 --- a/policy/modules/services/container.te +++ b/policy/modules/services/container.te @@ -756,6 +756,9 @@ kernel_request_load_module(container_engine_t) term_remount_devpts(container_engine_t) init_rw_script_stream_sockets(container_engine_t) +init_manage_utmp(container_engine_t) +init_manage_dir_utmp(container_engine_t) +init_mounton_initrc_runtime(container_engine_t) ifdef(`init_systemd',` # needed by runc, which is also invoked by other engines From d8dffd8fda28d7bd2c61b7e2df66bec62f328865 Mon Sep 17 00:00:00 2001 From: Mykola Solianko Date: Thu, 12 Feb 2026 15:40:10 +0200 Subject: [PATCH 6/8] [dnsmasq] Allow rw initrc stream sockets and aos conf Signed-off-by: Mykola Solianko Reviewed-by: Mykola Kobets Reviewed-by: Oleksandr Grytsov --- policy/modules/services/dnsmasq.te | 4 ++++ policy/modules/system/aos.if | 19 +++++++++++++++++++ 2 files changed, 23 insertions(+) diff --git a/policy/modules/services/dnsmasq.te b/policy/modules/services/dnsmasq.te index fab57cef22..cccaa0d593 100644 --- a/policy/modules/services/dnsmasq.te +++ b/policy/modules/services/dnsmasq.te @@ -110,6 +110,10 @@ userdom_dontaudit_search_user_home_dirs(dnsmasq_t) files_manage_quota_aos(dnsmasq_t) +init_rw_script_stream_sockets(dnsmasq_t) + +aos_rw_conf(dnsmasq_t) + dev_rw_tee_chr_files(dnsmasq_t) kernel_use_fds(dnsmasq_t) diff --git a/policy/modules/system/aos.if b/policy/modules/system/aos.if index 2852cd0391..246186cb33 100644 --- a/policy/modules/system/aos.if +++ b/policy/modules/system/aos.if @@ -206,6 +206,25 @@ interface(`files_manage_overlay_aos',` ') +######################################## +## +## Read and write aos conf directories and files. +## +## +## +## Domain allowed access. +## +## +# +interface(`aos_rw_conf',` + gen_require(` + type aos_conf_t; + ') + + allow $1 aos_conf_t:dir rw_dir_perms; + allow $1 aos_conf_t:file rw_file_perms; +') + ######################################## ## ## Allow relabeled /var/aos directory. From 38279b615229862ddaa344cb3574cba66c13336b Mon Sep 17 00:00:00 2001 From: Mykola Solianko Date: Thu, 26 Feb 2026 13:44:52 +0200 Subject: [PATCH 7/8] [rpc] Allow rpc.rquotad to read net sysctls and get aos fs quotas Signed-off-by: Mykola Solianko Reviewed-by: Mykola Kobets Reviewed-by: Oleksandr Grytsov Reviewed-by: Mykhailo Lohvynenko --- policy/modules/services/rpc.te | 5 +++++ policy/modules/system/aos.if | 18 ++++++++++++++++++ 2 files changed, 23 insertions(+) diff --git a/policy/modules/services/rpc.te b/policy/modules/services/rpc.te index 63f2ce9295..d43da694b7 100644 --- a/policy/modules/services/rpc.te +++ b/policy/modules/services/rpc.te @@ -245,6 +245,7 @@ can_exec(rpcd_t, rpcd_exec_t) kernel_read_network_state(rpcd_t) kernel_read_sysctl(rpcd_t) +kernel_read_net_sysctls(rpcd_t) kernel_rw_fs_sysctls(rpcd_t) kernel_dontaudit_getattr_core_if(rpcd_t) kernel_signal(rpcd_t) @@ -309,6 +310,10 @@ optional_policy(` quota_manage_db_files(rpcd_t) ') +optional_policy(` + aos_get_fs_quotas(rpcd_t) +') + optional_policy(` unconfined_signal(rpcd_t) ') diff --git a/policy/modules/system/aos.if b/policy/modules/system/aos.if index 246186cb33..9292c5f2d0 100644 --- a/policy/modules/system/aos.if +++ b/policy/modules/system/aos.if @@ -167,6 +167,24 @@ interface(`files_manage_quota_aos',` allow $1 aos_var_run_t:filesystem { quotaget quotamod remount getattr }; ') +######################################## +## +## Get quotas on aos filesystem. +## +## +## +## Domain allowed access. +## +## +# +interface(`aos_get_fs_quotas',` + gen_require(` + type aos_var_run_t; + ') + + allow $1 aos_var_run_t:filesystem quotaget; +') + # allow $1 aos_var_run_t:file { getattr }; ######################################## From 6993b129b85ff5b7d51521b05f2acaed3f5b5f23 Mon Sep 17 00:00:00 2001 From: Mykola Solianko Date: Fri, 27 Feb 2026 19:02:18 +0200 Subject: [PATCH 8/8] [rpc] Allow rpc_domain to bind unreserved ports (1024-65535) Signed-off-by: Mykola Solianko Reviewed-by: Mykola Kobets Reviewed-by: Oleksandr Grytsov Reviewed-by: Mykhailo Lohvynenko --- policy/modules/services/rpc.te | 2 ++ 1 file changed, 2 insertions(+) diff --git a/policy/modules/services/rpc.te b/policy/modules/services/rpc.te index d43da694b7..fdf45cc036 100644 --- a/policy/modules/services/rpc.te +++ b/policy/modules/services/rpc.te @@ -118,6 +118,8 @@ corenet_tcp_bind_generic_port(rpc_domain) corenet_udp_bind_generic_port(rpc_domain) corenet_tcp_bind_all_rpc_ports(rpc_domain) corenet_udp_bind_all_rpc_ports(rpc_domain) +corenet_tcp_bind_all_unreserved_ports(rpc_domain) +corenet_udp_bind_all_unreserved_ports(rpc_domain) fs_rw_rpc_named_pipes(rpc_domain) fs_search_auto_mountpoints(rpc_domain)